p41275903
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Zoo: Add second hop bb test 

Added new powershell-3-48 machine for second hop test.
Explanation why cached are not working after the first hop.
Documentation for the zoo.
This commit is contained in:
Ilija Lazoroski 2021-09-24 15:29:11 +02:00
parent 089158a976
commit b90e9ccf21
6 changed files with 65 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
envs/monkey_zoo/blackbox/config_templates/powershell.py
View File

@ -10,10 +10,15 @@ class PowerShell(ConfigTemplate):
config_values.update(
{
"basic.exploiters.exploiter_classes": ["PowerShellExploiter"],
"basic_network.scope.subnet_scan_list": ["10.2.3.45", "10.2.3.46", "10.2.3.47"],
"basic_network.scope.subnet_scan_list": [
"10.2.3.45",
"10.2.3.46",
"10.2.3.47",
"10.2.3.48",
],
"basic.credentials.exploit_password_list": ["Passw0rd!"],
"basic_network.scope.depth": 2,
"basic.credentials.exploit_user_list": ["m0nk3y", "m0nk3y-user"],
"basic_network.scope.depth": 2, # TODO: Remove .\\ when DC name is added
"basic.credentials.exploit_user_list": ["m0nk3y", "m0nk3y-user", ".\\m0nk3y"],
"internal.classes.finger_classes": ["PingScanner"],
"internal.network.tcp_scanner.HTTP_PORTS": [],
"internal.network.tcp_scanner.tcp_target_ports": [],

1
envs/monkey_zoo/blackbox/gcp_test_machine_list.py
View File

@ -25,5 +25,6 @@ GCP_TEST_MACHINE_LIST = {
"powershell-3-45",
"powershell-3-46",
"powershell-3-47",
"powershell-3-48",
],
}

37
envs/monkey_zoo/docs/fullDocs.md
View File

@ -34,8 +34,9 @@ This document describes Infection Monkey’s test network, how to deploy and use
[Nr. 3-45 Powershell](#_Toc536021479)<br>
[Nr. 3-46 Powershell](#_Toc536021480)<br>
[Nr. 3-47 Powershell](#_Toc536021481)<br>
[Nr. 250 MonkeyIsland](#_Toc536021482)<br>
[Nr. 251 MonkeyIsland](#_Toc536021483)<br>
[Nr. 3-48 Powershell](#_Toc536021482)<br>
[Nr. 250 MonkeyIsland](#_Toc536021483)<br>
[Nr. 251 MonkeyIsland](#_Toc536021484)<br>
[Network topography](#network-topography)<br>
# Warning\!
@ -1171,7 +1172,35 @@ fullTest.conf is a good config to start, because it covers all machines.
<table>
<thead>
<tr class="header">
<th><p><span id="_Toc536021482" class="anchor"></span>Nr. <strong>250 MonkeyIsland</strong></p>
<th><p><span id="_Toc536021482" class="anchor"></span>Nr. <strong>3-48 Powershell</strong></p>
<p>(10.2.3.48)</p></th>
<th>(Vulnerable)</th>
</tr>
</thead>
<tbody>
<tr class="odd">
<td>OS:</td>
<td><strong>Windows Server 2019 x64</strong></td>
</tr>
<tr class="even">
<td>Software:</td>
<td>WinRM service</td>
</tr>
<tr class="odd">
<td>Default server’s port:</td>
<td>-</td>
</tr>
<tr class="even">
<td>Notes:</td>
<td>User: m0nk3y, Password: Passw0rd!</td>
</tr>
</tbody>
</table>
<table>
<thead>
<tr class="header">
<th><p><span id="_Toc536021483" class="anchor"></span>Nr. <strong>250 MonkeyIsland</strong></p>
<p>(10.2.2.250)</p></th>
<th></th>
</tr>
@ -1203,7 +1232,7 @@ fullTest.conf is a good config to start, because it covers all machines.
<table>
<thead>
<tr class="header">
<th><p><span id="_Toc536021483" class="anchor"></span>Nr. <strong>251 MonkeyIsland</strong></p>
<th><p><span id="_Toc536021484" class="anchor"></span>Nr. <strong>251 MonkeyIsland</strong></p>
<p>(10.2.2.251)</p></th>
<th></th>
</tr>

4
envs/monkey_zoo/terraform/images.tf
View File

@ -57,6 +57,10 @@ data "google_compute_image" "mssql-16" {
name = "mssql-16"
project = local.monkeyzoo_project
}
data "google_compute_image" "powershell-3-48" {
name = "powershell-3-48"
project = local.monkeyzoo_project
}
data "google_compute_image" "powershell-3-47" {
name = "powershell-3-47"
project = local.monkeyzoo_project

15
envs/monkey_zoo/terraform/monkey_zoo.tf
View File

@ -313,6 +313,21 @@ resource "google_compute_instance_from_template" "mssql-16" {
}
}
resource "google_compute_instance_from_template" "powershell-3-48" {
name = "${local.resource_prefix}powershell-3-48"
source_instance_template = local.default_windows
boot_disk{
initialize_params {
image = data.google_compute_image.powershell-3-48.self_link
}
auto_delete = true
}
network_interface {
subnetwork="${local.resource_prefix}monkeyzoo-main-1"
network_ip="10.2.3.48"
}
}
resource "google_compute_instance_from_template" "powershell-3-47" {
name = "${local.resource_prefix}powershell-3-47"
source_instance_template = local.default_windows

6
monkey/infection_monkey/exploit/powershell_utils/credentials.py
View File

@ -36,7 +36,9 @@ def get_credentials(
# On Windows systems, when username == None and password == None, the current user's credentials
# will be used to attempt to log into the victim.
# will be used to attempt to log into the victim only on the first hop, from island
# to a machine. Propagating after the first hop is not possible at the moment.
# See this: https://security.stackexchange.com/questions/120422/powershell-and-cached-credentials
def _get_empty_credentials(is_windows: bool) -> List[Credentials]:
if is_windows:
return [Credentials(username=None, secret=None, secret_type=SecretType.CACHED)]
@ -44,7 +46,7 @@ def _get_empty_credentials(is_windows: bool) -> List[Credentials]:
return []
# On Windows systems, when password == None, the current user's password will bu used to attempt to
# On Windows systems, when password == None, the current user's password will be used to attempt to
# log into the victim.
def _get_username_only_credentials(usernames: List[str], is_windows: bool) -> List[Credentials]:
credentials = [